Package
elasticsearch-9.5
Component
jackson-core
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The jackson-core copy reported here is shaded inside Apache Parquet's parquet-jackson module under shaded.parquet, which parquet-hadoop-bundle also includes, and cannot be updated independently of Apache Parquet. CVE-2026-89425 is fixed in jackson-core 2.22.3. No Apache Parquet release ships it: 1.18.1, the latest release, shades jackson-core 2.22.2, and the 1.18.x and 1.19.x release branches also pin 2.22.2. The upgrade to jackson 2.22.3 was merged to the development branch on 2026-10-04 and is not yet in a release. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-89425 https://github.com/advisories/GHSA-7hhh-6rmp-j9qf https://github.com/apache/parquet-java/pull/3834 https://github.com/apache/parquet-java/blob/apache-parquet-1.18.1/pom.xml#L78 https://repo1.maven.org/maven2/org/apache/parquet/parquet-jackson/
Status